core-rules SKILL.md skillA
core-rules from ninjasln-labs/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ninjasln-labs/agent-skills/core-rules@v1.1.1Pins v1.1.1 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ninjasln-labs/agent-skills
- Path
core-rules/SKILL.md- Versions recorded
- 5
- Latest version
- v1.1.1, committed Sep 22, 2026
- First version recorded
- Aug 3, 2026
- Size
- 3,957 bytes
- Repository stars
- 3
- License
- none declared
RETIRED 2026-09-17 — the consumer link was removed; this source is kept for reference only. Its surviving bottom line (no plaintext secrets) now lives in the user-level AGENTS.md memory; the session-progress rule is covered by project-handoff (formerly project-intake); permission-confirmation and long-task-feedback were dropped. Original text — global rules applicable to all projects/sessions across AI coding tools (Deep Code / Cursor, etc.), four bottom lines: credential safety…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 全局规则（Global Rules）——**已退役** > **本技能已退役（2026-09-17）**：消费侧链接已摘（`~/.agents/skills/core-rules` 不存在），真源保留仅供追溯。 > 四条规则的最终去处： > 1. **禁止明文密码** → 用户级 memory `~/.commandcode/AGENTS.md`「通用硬约束」（该层每个项目都加载，是硬规则的常驻归宿） > 2. **权限确认** → **废弃**（各 agent 自带权限控制，规则冗余） > 3. **长任务反馈** → **废弃**（各 agent 已具备进度反馈能力） > 4. **会话进度** → 收敛为单一交接文档，见 `project-handoff`（原 `project-intake`；不再单独维护 `.agents/session.md`） > > 以下为退役时的原文，**仅供追溯，勿直接照用**——若需重新启用，先核对上述去处是否已被新的单一来源覆盖。 --- 以下 4 条规则适用于所有项目。 ## 1. 禁止明文密码 密码、API Key、Token、Secret 等敏感凭证，**禁止以明文形式出现**在代码、配置、日志、对话输出中。 - 代码从项目 `config/secrets.json` 读取凭证 - 示例/模板中用占位符（`your-key-here`） - 对话中不暴露真实密钥 ## 2. 权限确认 涉及写操作（文件修改、Git、脚本执行、网络请求、远程命令等），**必须先说明并获确认**。 - **只读除外**：纯查询、拉日志、列清单、生成计划可先做 - **确认内容**：范围 + 动作深度 + 影响与回滚 - 禁止因口语简称（如"清一下"）默认全量或默认破坏性步骤 ## 3. 长任务反馈 预估超过 60 秒的任务，执行中必须持续反馈进度。 - **禁止**盲 sleep / 固定倒计时当主要等待手段 - 优先用完成信号（`exit_code`、progress JSON），再短轮询 - 连续 60s 内至少一条进度；无变化也报「仍在运行」 - 失败：自检 → 定位 → 汇报 → **等用户决策**（除非已授权自动重试） - 需要稳定轮询时用 `task-loop-progress` Skill ## 4. 会话进度 每个项目独立维护自己的 `session.md`，放在 `<project>/.agents/session.md`。 工作区根目录的 `.agents/session.md` 仅存跨项目信息（子项目清单、全局待定方向），不存放任何单个项目的进度。 ### 分层 …
Read the whole file at its exact version.
How to install
mdr add ninjasln-labs/agent-skills/core-rules@sha256:019cd9a2ebbe4444The line at the top of this page pins the label v1.1.1, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_2v2wnkp2fdvyrfna)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Aug 3, 2026 and Sep 22, 2026, about one every 13 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.1.1 latest | 2026-09-22 | 75c75c0 | 3,957 B | A | view · diff |
| v1.1.0 | 2026-09-18 | cbc6719 | 3,944 B | A | view · diff |
| v1.0.0 | 2026-09-07 | 571fb57 | 2,823 B | A | view · diff |
| git:20260813.1cc67b3 | 2026-08-13 | 1cc67b3 | 2,767 B | A | view · diff |
| git:20260803.cf548c9 | 2026-08-03 | cf548c9 | 2,782 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3957 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ninjasln-labs/agent-skills · 3 stars · license none declared · pushed 2026-10-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_2v2wnkp2fdvyrfna GET https://markdownregistry.com/api/v1/resolve?ref=ninjasln-labs/agent-skills/core-rules GET https://markdownregistry.com/api/v1/blob/019cd9a2ebbe44441b14366ddfe5b032d8a3f4bdbfe95ae77c664b504560191c
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.